security/capability.h: cap_issubset/isclear can be boolean